Kamal Shah is co-founder and CEO of Prophet Security, a leading provider of Agentic AI SOC Platform.
For the past decade, managed detection and response (MDR) has been the practical answer to a straightforward problem: most organizations cannot staff a security operations center around the clock with experienced analysts. MDR providers filled that gap, and for many companies, particularly in the mid-market, it worked well enough. You pay a monthly fee, alerts flow to an external team and investigators you never meet handle triage on your behalf.
That model is now under real structural pressure, and the source of that pressure is AI.
I run Prophet Security, an AI SOC platform, so I have a stake in where this goes, and I want to be clear upfront: this is not an argument that managed services are going away. Security has more demand than supply, and that imbalance is not shrinking. But how organizations consume investigation and response is shifting in ways both MDR providers and their customers need to think about carefully.
The Economics That Built MDR
MDR exists because investigation is expensive. A competent SOC analyst costs six figures fully loaded, works eight-hour shifts and can investigate a limited number of alerts per day. Around-the-clock coverage means multiple shifts and analysts, plus management, tooling and training, hard for a mid-market company to justify in-house. MDR providers solved this by pooling analyst capacity across customers, bringing the per-customer cost down to a manageable level. The model delivers real value, but its constraints grow more visible as alert volumes rise and expectations around investigation quality and response time tighten.
Where The Strain Shows Up
Security leaders who have run under MDR for a few years surface recurring friction.
Custom detections are hard to get built. Providers optimize coverage for what is common across their customer base, not for what is unique to a single environment. If your detection need falls outside the standard rule set, getting it written and operationalized is slow, if it happens at all.
Investigation logic does not always reflect your context. A shared analyst may not know that a particular service account is expected to behave in ways that would look anomalous elsewhere. That context separates a thorough investigation from a generic one, and it is expensive to maintain per customer in a shared model.
These are structural features of a model built on shared human resources at scale.
What AI Changes In This Equation
AI SOC platforms change the cost curve of investigation. An AI SOC analyst can pick up an alert, gather context across your SIEM, EDR, identity provider and cloud, correlate evidence and produce a full investigation narrative in minutes, at a marginal cost that is a fraction of a human analyst’s and does not degrade when volume spikes. When we built Prophet Security’s AI SOC analyst, the goal was to investigate every alert at the same depth rather than triage a subset faster.
Coverage stops being a trade-off. An AI SOC platform investigates every alert, not just the ones that fit a shared team’s capacity. Prophet Security’s research found that 40% of alerts go uninvestigated in most SOC environments, and 60% of teams have missed a critical alert. That gap exists because human investigation capacity is finite and expensive.
Customization becomes economically viable. An AI SOC platform can be configured to understand your environment: your service accounts, exception policies, risk tolerance and the particular mix of tools in your stack. The Prophet AI SOC platform tailors itself to each customer’s context without adding analyst headcount, so the marginal cost of that customization stays near zero. This is where the contrast with MDR is sharpest. The economic pressure that pushes managed services toward standardized workflows does not apply to an AI SOC platform.
Investigation quality becomes consistent and reviewable. Every investigation follows the same process, produces a transparent reasoning trail and can be audited after the fact.
What This Means For MDR Providers
Smart MDR providers are already adapting, integrating AI into their workflows or repositioning around what AI handles less well today: incident response retainers, hands-on threat hunting, compliance reporting and strategic advisory. The most exposed parts are the high-volume, repeatable ones: alert triage, initial investigation and false-positive resolution. What endures is the work that requires judgment and communication under pressure, including incident response during a real breach, architectural decisions and hypothesis-driven threat hunting that depends on human creativity. The likely outcome is not that MDR disappears but that its scope narrows and shifts upmarket, toward engagements that look quite different from today’s contracts.
Consider These Questions
For security leaders evaluating or renewing MDR, the shift raises a few questions.
What share of what your MDR delivers is standardized triage versus investigation tailored to your environment? The standardized portion is the part most likely to move to AI first.
Then there is resource allocation: If AI absorbs that baseline workload, where do your budget and people go next?
That is the opportunity; the risk deserves equal weight. The first is accountability for accuracy: Can you see the reasoning behind a verdict and stand behind it, rather than trust an unseen MDR analyst? The second is autonomy: Decide what the AI can do alone and what needs a human, keeping containment like disabling an account behind a person. The third is proof: Validate it on your own alerts.
The Bigger Picture
The industry has spent years acknowledging that there are not enough skilled analysts to meet demand. MDR was one answer. AI is another, and on cost, scalability and consistency, it is increasingly the more compelling option for the investigative workload that dominates most SOC operations.
This does not mean canceling your MDR contract tomorrow. Transitions take time, and many teams will want a period of overlap. But the direction is clear enough that buyers and providers both benefit from planning now. The teams that navigate it well will decide deliberately which capabilities to own, which to rent and how AI changes the calculus between them.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
